What’s Vulnerable › Vulnerabilities

CVE-2023-24512: On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch.

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-04-25 · updated 2026-06-17
• Weakness: CWE-284

Description

On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. This situation occurs only when the Streaming Telemetry Agent (referred to as the TerminAttr agent) is enabled and gNMI access is configured on the agent. Note: This gNMI over the Streaming Telemetry Agent scenario is mostly commonly used when streaming to a 3rd party system and is not used by default when streaming to CloudVision

Affected products

• Arista Ceos-Lab: all versions
• Arista Cloudeos: all versions
• Arista Networks EOS: from 4.26.0 before 4.26.10m; from 4.27.0 before 4.27.9m; from 4.28.0 before 4.28.6m; from 4.29.0 before 4.29.2f — fixed in 4.26.10m, 4.27.9m, 4.28.6m, 4.29.2f
• Arista Veos-Lab: all versions

How to fix

Upgrade to a fixed version: Arista Networks EOS 4.26.10m, 4.27.9m, 4.28.6m, 4.29.2f. Check the vendor advisory for mitigations.

References

• https://www.arista.com/en/support/advisories-notices/security-advisory/17250-security-advisory-0086
• https://www.arista.com/en/support/advisories-notices/security-advisory/17250-security-advisory-0086

Get alerted when CVE-2023-24512 or the next vulnerability affects your stack